IBM How to determine if a TIP server is part of a HA cluster - United States TIPL2; TIPL2CONF; TIPL2HALB; Load balancing; high availability; Tivoli Integrated Portal; HA; TIP; HATool; modules; database TECHNOTE (FAQ)

QUESTION
 What steps can be used to determine if a Tivoli Integrated Portal server is part of a High Availability server group?

ANSWER
Use the HATool.{bat|sh} command located in the <TIP HOME>/profiles/TIPProfile/bin/ha directory. The usage for that command is:
HATool.{bat|sh} modules <db2 username> <db2 password>

If this returns a list of modules, then HA is configured and the server is joined.
If this returns empty, then HA is configured, but server is disjoined.
If this throws Database Connection errors, then HA has never been configured on this server.

See the following technical note for complete details on High Availability/load balancing configuration:

http://pic.dhe.ibm.com/infocenter/tivihelp/v15r1/topic/com.ibm.tip.doc/ctip_config_ha_ovw.html [http://pic.dhe.ibm.com/infocenter/tivihelp/v15r1/topic/com.ibm.tip.doc/ctip_config_ha_ovw.html]

Question: Why are ITNM or Omnnibus WebGUI java applets fail to load with "Missing Permissions manifest attribute in main jar" Why are ITNM or Omnnibus WebGUI java applets fail to load with "Missing Permissions manifest attribute in main jar"

Answer:
Use the HATool.{bat|sh} command located in the <TIP HOME>/profiles/TIPProfile/bin/ha directory. The usage for that command is:
HATool.{bat|sh} modules <db2 username> <db2 password>

If this returns a list of modules, then HA is configured and the server is joined.
If this returns empty, then HA is configured, but server is disjoined.
If this throws Database Connection errors, then HA has never been configured on this server.


IBM Steps to disable RC4 SSL ciphers in Tivoli Integrated Portal - United States TIPL2SSL; TIPL2; TIPL2CONF; RC4; cipher; SSL TECHNOTE (FAQ)

QUESTION
 What are the steps to disable RC4 ciphers from TIP?

CAUSE
Security scans may suggest disabling RC4 ciphers

ANSWER
To remove RC4 ciphers:

 1. Log into the Websphere Application server and navigate to:
    SSL certificate and key management > SSL configurations > NodeDefaultSSLSettings > Quality of protection (QoP)

 2. Select the *RC4* ciphers from the "Selected ciphers" list, and then click the "<<Remove" button.

 3.  Click the "Apply" button, and then the "Save (to the master configuration)" link.

 4. Restart TIP.

Question: Is it possible to controle which ciphers are available in Tivoli Integrated Portal? Is it possible to controle which ciphers are available in Tivoli Integrated Portal?

Answer:
To remove RC4 ciphers:

 1. Log into the Websphere Application server and navigate to:
    SSL certificate and key management > SSL configurations > NodeDefaultSSLSettings > Quality of protection (QoP)

 2. Select the *RC4* ciphers from the "Selected ciphers" list, and then click the "<<Remove" button.

 3.  Click the "Apply" button, and then the "Save (to the master configuration)" link.

 4. Restart TIP.


IBM Action required for IBM WebSphere MQ Hypervisor Edition for Red Hat Enterprise Linux Server for the GNU C library (glibc) vulnerability (CVE-2015-0235) - United States  FLASH (ALERT)

ABSTRACT
 IBM WebSphere MQ Hypervisor Edition for Red Hat Enterprise Linux Server requires customer action for the GNU C library (glibc) vulnerability that has been referred to as "GHOST".

CONTENT
IBM WebSphere MQ Hypervisor Edition for Red Hat Enterprise Linux Server ships with Red Hat Enterprise Linux (RHEL) that is vulnerable to the GNU C library (glibc) vulnerability (CVE-2015-0235).

Remediation:
IBM strongly recommends that you should contact Red Hat to obtain fixes and install fixes for Red Hat Enterprise Linux (RHEL).

Change History:
January 29, 2015: Original version published

RELATED INFORMATION
 Red Hat Customer Portal - GHOST vulnerability [https://access.redhat.com/articles/1332213]
A Japanese translation is available [http://www.ibm.com/support/docview.wss?uid=swg21696879]

Question: What action is required for IBM WebSphere MQ Hypervisor Edition for Red Hat Enterprise Linux Server for the GNU C library (glibc) vulnerability (CVE-2015-0235)? IBM WebSphere MQ Hypervisor Edition for Red Hat Enterprise Linux Server requires customer action for the GNU C library (glibc) vulnerability that has been referred to as "GHOST". What action is required?

Answer: IBM strongly recommends that you should contact Red Hat to obtain fixes and install fixes for Red Hat Enterprise Linux (RHEL).


IBM Correct understanding of CSV version of PVU reports - United States  TECHNOTE (FAQ)

QUESTION
 What files are in the audit snapshot generated by IBM License Metric Tool or IBM BigFix Inventory version 9.x, and what is the correct interpretation of the values in the CSV report files?

CAUSE
The licensing reports in CSV format can be misinterpreted by some customers.

ANSWER
Audit snapshot is a record of PVU and RVU MAPC utilization in your enterprise over a period of time. It contains the following files:

 * audit_trail.csv – all user actions that influence the final results of the licensing reports, for example, software classification actions, uploads and imports of the PVU table, software catalog, and charge units as well as changes to the VM managers.
 * data_conditions.txt – conditions that were used during the generation of the audit snapshot, including the reporting period and filters applied on the reports as well as general information about the time when the snapshot was generated, version of the PVU table and software catalog, status of the import, aggregation, and recalculation.
 * part_numbers.csv - part numbers that are listed in the software catalog for all software products that are included in any of the CSV report files.
 * pvu_full_capacity.csv - PVU full capacity license metric results
 * pvu_sub_capacity.csv - PVU subcapacity license metric results
 * rvu_full_capacity.csv - RVU full capacity license metric results
 * rvu_sub_capacity.csv - RVU subcapacity license metric results
 * bundling_definitions.csv - list of IBM software regardless of its license type and utilization together with details of the computers on which the software is installed
 * readme.txt - a link to this document (technote)
 * checksums.txt, signature.rsa, and pub_key.pem - files used by IBM auditors to verify the authenticity and correctness of the audit snapshot.

Why some product instances are not listed in the CSV reports?

CSV reports with information about PVU and RVU MAPC utilization (pvu_full_capacity.csv, pvu_sub_capacity.csv, rvu_full_capacity.csv, and rvu_sub_capacity.csv) list only software instances that were discovered during the license peak value time. If an instance was installed in your environment during the reporting period of the current audit snapshot but was not discovered during the license peak value time, the instance is not listed in the CSV reports.

Example:
Three instances of DB2 are installed. The reporting period is set to one month and DB2 license utilization is as follows:
· Instance 1 uses the maximum of 100 PVUs,
· Instance 2 uses the maximum of 300 PVUs,
· Instance 3 uses the maximum of 500 PVUs.

The license peak value occurs when the sum of PVU values for all instances is the highest and equals 800 PVUs (300 PVUs for instance 2 + 500 PVUs for instance 3). The peak occurs during the period that is marked with a red square (it is the license peak value time). The peak usage for instance 1 is outside of the red square. It means that this instance was installed in the environment during the current reporting period but was not discovered during the license peak value time. This instance is not listed in the CSV report.

[/support/docview.wss?uid=swg21688543&aid=1] [/support/docview.wss?uid=swg21688543&aid=1]

Why some values from the CSV report do not relate back to what is displayed on the user interface?

When all values from column M (Physical Server PVU Subcapacity) for a particular product are added, the obtained value is greater that the value that is displayed in the user interface. It happens due to the way that data is presented in CSV reports and on the user interface.

The All IBM Metrics and IBM PVU subcapacity reports are multilevel, and consist of the following levels:
1. First level: a list of all products
[/support/docview.wss?uid=swg21688543&aid=2] [/support/docview.wss?uid=swg21688543&aid=2]

2. Second level: when you click a product name, you go to information about the physical server on which the product is installed.
[/support/docview.wss?uid=swg21688543&aid=3] [/support/docview.wss?uid=swg21688543&aid=3]

3. Third level: when you click the server name, you go to a list of virtual machines that run on this server and have the product installed.
[/support/docview.wss?uid=swg21688543&aid=4] [/support/docview.wss?uid=swg21688543&aid=4]

The audit snapshot is not multilevel. However, it has to present the same information that the report that is available in the user interface. Below is an excerpt from the audit snapshot that corresponds to the report that was presented on the screen shots above (some columns are hidden in the snapshot to simplify it).

[/support/docview.wss?uid=swg21688543&aid=5] [/support/docview.wss?uid=swg21688543&aid=5]

When values in column M are added, PVU consumption equals 480 PVUs. However, these values should not be added because they all refer to a single server (TLM_VM_423…) on which the four VMs run, not an individual VM that is listed in column P (Computer).

The value in column M is repeated due to the way data needs to be presented in a CSV file. If you want to relate back the value from column M in the audit snapshot to the user interface report, it is the value that you can see in the column PVU Subcapacity Limit on the second level of the report. The value in column L relates back to the column CPU Core Subcapacity on the second level of the report.

[/support/docview.wss?uid=swg21688543&aid=6] [/support/docview.wss?uid=swg21688543&aid=6]

PVU and RVU MAPC subcapacity license terms specify license consumption only on the physical server level. PVU and RVU MAPC values cannot be calculated and presented on the virtual machine or LPAR level, and such data is not provided by License Metric Tool or BigFix Inventory. For more information about virtualization capacity license counting rules that are used for PVU and RVU MAPC calculation, see:
http://www-01.ibm.com/software/passportadvantage/Counting_Software_licenses_using_specific_virtualization_technologies.html [http://www-01.ibm.com/software/passportadvantage/Counting_Software_licenses_using_specific_virtualization_technologies.html]

RELATED INFORMATION
 Understanding CSV files with metric utilization [https://www.ibm.com/support/knowledgecenter/en/SS8JFY_9.2.0/com.ibm.lmt.doc/Inventory/softinv/c_understanding_csv.html]

Cross reference information Segment Product Component Platform Version Edition Security IBM BigFix Inventory

Question:
Can I see the exact number of PVU used in our VM environment Hi,

Happy new year!

Can I see the exact number of PVU used in our VM environment, if yes, how to check? I want to be sure that we are using correct number of PVU we have license for.

We have installed Datastage on a windows 2016 standard server with 2 processor and 2 cores per processor assigned to this virtual server. The blade server that is used by this datastage server has 2 processors, 6 cores each.

After configuring ILMT for the first time, the metric reports showed 120 PVU per core, so a total of 480 full capacity. Then we defined VM manager, and now reports show a PVU total of 840 full capacity and 480 sub capacity.

Answer:
pvu_full_capacity.csv - PVU full capacity license metric results
 * pvu_sub_capacity.csv - PVU subcapacity license metric results


IBM Java SDK Upgrade Policy for the IBM WebSphere Application Server - United States upgrade policy TECHNOTE (FAQ)

QUESTION
 What is the Java™ SDK upgrade policy for the IBM® WebSphere® Application Server?

CAUSE
Updating to the latest compatible Java SDK could help you resolve problems more quickly.

ANSWER
The IBM WebSphere Application Server Java SDK can be upgraded to the latest service release for the same Java SDK version.

List of WebSphere Application Server fix packs and the corresponding Java SDK versions [http://www.ibm.com/support/docview.wss?rs=180&uid=swg27005002]

Policy Summary by WebSphere Application Server release:

WebSphere Application Server V8.0, V8.5, V8.5.5
Starting with V8.0 and applicable to all subsequent releases and fixpacks, there is one install package that contains updates for both WebSphere Application Server and Java SDK. Applying fixpacks of WebSphere Application Server also upgrades the SDK that is packaged and bundled within the fixpack. Additionally, separate Java SDK fixpacks are also available that contain just the SDK updates which can be applied to upgrade the SDK.

WebSphere Application Server V7.0
Any V7.0 fix pack can upgrade to the latest Java SDK 1.6.0 service release packaged for WebSphere Application Server.

WebSphere Application Server V6.1
Any V6.1 fix pack can upgrade to the latest Java SDK 1.5.0 service release packaged for WebSphere Application Server.

WebSphere Application Server V6.0
Any V6.0 fix pack can upgrade to the latest Java SDK 1.4.2 service release packaged for WebSphere Application Server.

WebSphere Application Server V5.1
Any V5.1 fix pack can upgrade to the latest Java SDK 1.4.1 and any V5.1.1 can be upgraded to the latest Java SDK 1.4.2 service release packaged for WebSphere Application Server.

WebSphere Application Server V5.0
Any V5.0 fix pack can upgrade to the latest Java SDK 1.3.1 service release packaged for WebSphere Application Server.

Details of Java SDK Upgrade Policy

WebSphere Application Server leverages the Java SDK as a base component. This results in unique support issues, including:

 * Matching Java SDK service releases to Application Server releases and fix packs

 * Delivering updates and fixes associated with the Java SDK on any given Application Server release.

In an effort to resolve customer Java SDK situations as quickly as possible, WebSphere Application Server Support has done a quickest-path-to-resolution analysis, determining the most direct way to collect problem information.

In some cases, problem resolution might include finding shortcuts to resolve symptoms. One shortcut is an immediate upgrade to a newer compatible Java SDK service release, before gathering detailed problem determination data.

There are multiple advantages to performing an immediate Java SDK upgrade as a quicker path to resolution over a full Problem Determination (PD) process:
 1. There is a continuous stream of fixes going into the Java SDK. Many problems encountered by customers are resolved by these fixes.

 2. When a new problem is encountered, applying the latest Java SDK is a quick way to determine if related fixes change the symptoms or correct the problem.

 3. Many documented Java SDK fixes have common symptoms. Frequently, limited PD data does not isolate the problem to a single root cause.

These factors highlight the advantage of applying a newer Java SDK before working through a full PD cycle.

Java SDK and WebSphere Application Server software are updated frequently. To avoid compatibility issues for customers, WebSphere Application Server Support maintains this Java SDK Upgrade Policy.

WebSphere Application Server Support details:
http://www.ibm.com/software/webservers/appserv/support.html [http://www.ibm.com/software/webservers/appserv/support.html]

Identifying compatibility limitations between WebSphere Application Server releases and Java SDK service releases that have not been tested together reduces risk.

Important: Using a Java SDK not specifically packaged with WebSphere Application Server and supplied by IBM, or in violation of the Java SDK Upgrade Policy, is not supported by IBM WebSphere Application Server Support for Java SDK problems. RELATED INFORMATION
 Verify Java SDK version shipped with WebSphere fix pack [http://www.ibm.com/support/docview.wss?rs=180&uid=swg27005002]

Cross reference information Segment Product Component Platform Version Edition Application Servers Runtimes for Java Technology Java SDK

Question: Installing fixpacks with Installation Manager - when did it change from using updateInstaller,  starting in which version of WebSphere I was using updateInstaller to install fixpacks, and there was a separate fixpack for WebSphere and separate for the JDK, independent of each other. Now I understand that with Installation Manager there is a single package containing both the WebSphere App server fixpack as well as the JDK. When did this occur, starting with which version of WebSphere ?

Answer: Starting with V8.0 and applicable to all subsequent releases and fixpacks, there is one install package that contains updates for both WebSphere Application Server and Java SDK. Applying fixpacks of WebSphere Application Server also upgrades the SDK that is packaged and bundled within the fixpack. Additionally, separate Java SDK fixpacks are also available that contain just the SDK updates which can be applied to upgrade the SDK.


IBM Message RT7507E: Unable to initialize Repository: Default occurs in SystemOut.log after successful database transfer from Derby to DB2 - United States  TECHNOTE (TROUBLESHOOTING)

PROBLEM
Message RT7507E: Unable to initialize Repository: Default occurs in SystemOut.log after successful database transfer from Derby to DB2

SYMPTOM
You may see this stacktrace in SystemOut.log after successfully completing the database transfer from Derby to DB2

[6/25/12 16:10:19:213 CEST] 0000002e InitServlet E INI8504E:One or more initialization step failed. Please check the server log for details.
com.ibm.icm.jcr.RepositoryExistsException: RT7507E: Unable to initialize Repository: Default.
at com.ibm.icm.jcr.RepositoryFactory.init(RepositoryFactory.java:218)
at com.ibm.icm.jcr.RepositoryFactory.getRepository(RepositoryFactory.java:479)
at com.ibm.icm.jcr.servlet.InitServlet.init(InitServlet.java:56)
at com.ibm.ws.webcontainer.servlet.ServletWrapper.init(ServletWrapper.java:336)
at com.ibm.ws.webcontainer.servlet.ServletWrapperImpl.init(ServletWrapperImpl.java:168)
at com.ibm.ws.webcontainer.servlet.ServletWrapper.loadOnStartupCheck(ServletWrapper.java:1341)
at com.ibm.ws.webcontainer.webapp.WebApp.doLoadOnStartupActions(WebApp.java:588)
at com.ibm.ws.webcontainer.webapp.WebApp.commonInitializationFinally(WebApp.java:559)
at com.ibm.ws.webcontainer.webapp.WebAppImpl.initialize(WebAppImpl.java:421)
at com.ibm.ws.webcontainer.webapp.WebGroupImpl.addWebApplication(WebGroupImpl.java:88)
at com.ibm.ws.webcontainer.VirtualHostImpl.addWebApplication(VirtualHostImpl.java:169)
at com.ibm.ws.webcontainer.WSWebContainer.addWebApp(WSWebContainer.java:749)
at com.ibm.ws.webcontainer.WSWebContainer.addWebApplication(WSWebContainer.java:634)
at com.ibm.ws.webcontainer.component.WebContainerImpl.install(WebContainerImpl.java:422)
at com.ibm.ws.webcontainer.component.WebContainerImpl.start(WebContainerImpl.java:714)
at com.ibm.ws.runtime.component.ApplicationMgrImpl.start(ApplicationMgrImpl.java:1160)
at com.ibm.ws.runtime.component.DeployedApplicationImpl.fireDeployedObjectStart(DeployedApplicationImpl.java:1369)
at com.ibm.ws.runtime.component.DeployedModuleImpl.start(DeployedModuleImpl.java:638)
at com.ibm.ws.runtime.component.DeployedApplicationImpl.start(DeployedApplicationImpl.java:967)
at com.ibm.ws.runtime.component.ApplicationMgrImpl.startApplication(ApplicationMgrImpl.java:766)
at com.ibm.ws.runtime.component.ApplicationMgrImpl.start(ApplicationMgrImpl.java:2153)
at com.ibm.ws.runtime.component.CompositionUnitMgrImpl.start(CompositionUnitMgrImpl.java:445)
at com.ibm.ws.runtime.component.CompositionUnitImpl.start(CompositionUnitImpl.java:123)
at com.ibm.ws.runtime.component.CompositionUnitMgrImpl.start(CompositionUnitMgrImpl.java:388)
at com.ibm.ws.runtime.component.CompositionUnitMgrImpl.access$500(CompositionUnitMgrImpl.java:116)
at com.ibm.ws.runtime.component.CompositionUnitMgrImpl$CUInitializer.run(CompositionUnitMgrImpl.java:994)
at com.ibm.wsspi.runtime.component.WsComponentImpl$_AsynchInitializer.run(WsComponentImpl.java:349)
at com.ibm.ws.util.ThreadPool$Worker.run(ThreadPool.java:1659)

CAUSE
Root cause was having another copy of icm.properties in .\wp_profile\PortalServer\jcr\lib\com\ibm\icm, in this case by making a backup copy in the same directory with name icm-copy.properties

RESOLVING THE PROBLEM
Remove the copy so that the only file in .\wp_profile\PortalServer\jcr\lib\com\ibm\icm is icm.properties

RELATED INFORMATION
 Fiddler [http://www.fiddlertool.com]
Plug-in MustGather [http://www-01.ibm.com/support/docview.wss?uid=swg21174894]
WebSphere Portal tracing [http://www-10.lotus.com/ldd/portalwiki.nsf/dx/WebSphere_Portal_runtime_logs_wp7]
IHS Rewrite rules (mod_rewrite Apache module) [http://publib.boulder.ibm.com/infocenter/wasinfo/fep/index.jsp?topic=%2Fcom.ibm.websphere.ihs.doc%2Finfo%2Fihs%2Fihs%2Frihs_apachemods.html]

Question:
How to access the 2nd portal profile?  Hello,

I created a second WebSphere portal profile (wp_profile2) under C:\IBM\WebSphere as part of setting up multi-profile environment on windows using WebSphere Portal 8.0.0.1 CF04/WAS 8.0.0.10. I started the WebSphere_Portal under this profile successfully and am trying to access this new portal profile from a web browser using http://<host>:port/wps/myportal. I tried all the ports listed in SystemOut log but none of them seem to work and the one that appears to work is writing below error in logs and is showing a blank page:

[11/10/15 9:45:13:374 PST] 00000044 SystemOut     O javax.servlet.jsp.JspException: com.ibm.portal.resolver.exceptions.LocalizedIOException: RT7507E: Unable to initialize Repository: Default.
[11/10/15 9:45:13:374 PST] 00000044 SystemOut     O  at com.ibm.wps.engine.templates.themes.Default.render(Default.java:237)
[11/10/15 9:45:13:374 PST] 00000044 SystemOut     O  at com.ibm.wps.engine.templates.ThemeTemplate.render(ThemeT

Does anyone have any idea of how to fix the above issues and get the portal access working?

Appreciate your help regarding this.

Thank you.

Answer: Remove the copy so that the only file in .\wp_profile\PortalServer\jcr\lib\com\ibm\icm is icm.properties


IBM How do I process Sparse data objects Identified in the Audit - United States  TECHNOTE (FAQ)

QUESTION
 How do I turn on sparse data object processing

ANSWER
After harvesting a volume, the audit may show "skipped - cannot
access data object", with a sparse data object message recorded in the details section.

To correct this problem, ensure that no jobs are running. SSH into the Data Server(s) and enter the following command at the prompt;

psql -U dfuser dfdata -c "insert into adminknobs (name,value,description,valuetype,use) VALUES ('read_sparse_files','1','Read sprase data objects','int','1')"

It should return the following;

INSERT 0 1

if so, enter the following command and wait for the UI to come back up;

service siqinit restart

You can now run harvests as normal and sparse data objects will be processed. If your are using a policy which backs up the original files and just leaves a sparse file viewable that when accessed, will pull the original file forward, you may run into space issues. This is because SIQ will be accessing every sparse file, so the sparse files' size on disk will grow to the same size as the original file.

Question: How do you switch on the indexing of sparse file in StoredIQ? By default these are skipped - does anyone know where to switch them on on the dataserver?

Answer:
SSH into the Data Server(s) and enter the following command at the prompt;

psql -U dfuser dfdata -c "insert into adminknobs (name,value,description,valuetype,use) VALUES ('read_sparse_files','1','Read sprase data objects','int','1')"

It should return the following;

INSERT 0 1

if so, enter the following command and wait for the UI to come back up;

service siqinit restart


IBM Security Bulletin: Multiple Vulnerabilities identified in IBM® Java SDK affect WebSphere Service Registry and Repository and WebSphere Service Registry and Repository Studio - United States  SECURITY BULLETIN

SUMMARY
 Multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6 used by WebSphere Service Registry and Repository and WebSphere Service Registry and Repository Studio. These issues were disclosed as part of the IBM Java SDK updates in January 2018.

These issues are also addressed by WebSphere Application Server Network Deployment shipped with WebSphere Service Registry and Repository.

VULNERABILITY DETAILS
CVEID:CVE-2018-2633 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2633]
DESCRIPTION:An unspecified vulnerability related to the Java SE JNDI component could allow an unauthenticated attacker to take control of the system.
CVSS Base Score: 8.3
CVSS Temporal Score: Seehttps://exchange.xforce.ibmcloud.com/vulnerabilities/137885 [https://exchange.xforce.ibmcloud.com/vulnerabilities/137885]for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)
CVEID:CVE-2018-2603 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2603]
DESCRIPTION:An unspecified vulnerability related to the Java SE Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: Seehttps://exchange.xforce.ibmcloud.com/vulnerabilities/137855 [https://exchange.xforce.ibmcloud.com/vulnerabilities/137855]for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2018-2579 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2579]
DESCRIPTION:An unspecified vulnerability related to the Java SE Libraries component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors.
CVSS Base Score: 3.7
CVSS Temporal Score: Seehttps://exchange.xforce.ibmcloud.com/vulnerabilities/137833 [https://exchange.xforce.ibmcloud.com/vulnerabilities/137833]for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID:CVE-2018-2602 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2602]
DESCRIPTION:An unspecified vulnerability related to the Java SE I18n component could allow an unauthenticated attacker to cause low confidentiality impact, low integrity impact, and low availability impact.
CVSS Base Score: 4.5
CVSS Temporal Score: Seehttps://exchange.xforce.ibmcloud.com/vulnerabilities/137854 [https://exchange.xforce.ibmcloud.com/vulnerabilities/137854]for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L)

AFFECTED PRODUCTS AND VERSIONS
WebSphere Service Registry and Repository V8.5 and V8.0 and WebSphere Service Registry and Repository Studio V8.5 are affected.

REMEDIATION/FIXES
For all releases of WebSphere Service Registry and Repository Studio, upgrade to WebSphere Service Registry and Repository Studio V8.5.6.1_IJ04332 [http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FWebSphere+Service+Registry+and+Repository&fixids=8.5.6.1-WS-WSRR-Studio-MultiOS-IFIJ04332]

For WebSphere Service Registry and Repository the issues are addressed by WebSphere Application Server.

Principal Product and Version(s) Affected Supporting Product and Version WebSphere Service Registry and Repository V8.5 WebSphere Application Server V8.5.5 WebSphere Service Registry and Repository V8.0 WebSphere Application Server V8.0
Refer to the following security bulletin for vulnerability details and information about fixes addressed by WebSphere Application Server shipped with WebSphere Service Registry and Repository:

Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affects WebSphere Application Server January 2018 CPU [http://www.ibm.com/support/docview.wss?uid=swg22013818] GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

REFERENCES
Complete CVSS v3 Guide [http://www.first.org/cvss/user-guide]
On-line Calculator v3 [http://www.first.org/cvss/calculator/3.0]

RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/psirt]

CHANGE HISTORY
 14 March 2018: Original version published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Question:
Help with Security Bulletin: Multiple Vulnerabilities identified in IBM Java SDK affect WSRR and WSRR Studio

I need to understand details regarding Security Bulletin: Multiple Vulnerabilities identified in IBM® Java SDK affect WebSphere Service Registry and Repository and WebSphere Service Registry and Repository Studio.

This is related to CVEID:
CVE-2018-2633
CVE-2018-2603
CVE-2018-2579
CVE-2018-2602

Where can I find this information?

Answer:
CVEID:CVE-2018-2633 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2633]
DESCRIPTION:An unspecified vulnerability related to the Java SE JNDI component could allow an unauthenticated attacker to take control of the system.
CVSS Base Score: 8.3
CVSS Temporal Score: Seehttps://exchange.xforce.ibmcloud.com/vulnerabilities/137885 [https://exchange.xforce.ibmcloud.com/vulnerabilities/137885]for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)


IBM Error # 2070. The license server is down. Specific symptom number: 3 - United States  TECHNOTE (FAQ)

QUESTION
 We have network installations of IBM SPSS Statistics/Modeler. When the application is launched, the following errors are reported:

"The current license does not permit this job to continue."

followed by...

"Error # 2070
The license server is down. Please check to see that the license server is running or ask your local SPSS coordinator to check the license server.
This command is not executed.
Specific symptom number: 3."

The Safenet Sentinel License Manager has been licensed and confirmed to be running.
What is the problem?

CAUSE
The above error can be caused by invalid values entered during the licensing phase of installing SPSS Statistics/Modeler or the client machine cannot reach the Sentinel License Manager host using the machine Hostname.

ANSWER
Please do the following to verify:

1. Navigate to the IBM SPSS Statistics/Modeler directory and open "spssprod.inf", using any text editor.

 - By default, SPSS Statistics would store this file in: C:\Program Files\IBM\SPSS\Statistics\xx\

 - By default, SPSS Modeler would store this file in: C:\Program Files\IBM\SPSS\Modeler\xx.x\bin\

2. Verify the "DaemonHost" value matches the Hostname or IP Address of the machine where the Safenet Sentinel License Manager is installed.

 - E.g. DaemonHost=MyLicenseServer or DaemonHost=127.0.0.1

If the DaemonHost value specifies redundant license servers, please do the following if you are using SPSS Statistics 22 (or earlier) or SPSS Modeler 16.0 (or earlier):

 a). Remove all license servers from the "DaemonHost" line and save the file.

b). Create a system environment variable, called LSHOST, on each SPSS client with your redundant license servers as its value. Separate each redundant license server with a colon, e.g.
==========================
Variable: LSHOST
Value: server1:server2:server3
==========================

If the "DaemonHost" value is accurate and you are using a Hostname value, you have a name resolution problem. Error # 2070, Symptom number 3 typically means the SPSS client cannot connect to the name resolution database or the name resolution database does not contain a record for the machine where the SPSS Sentinel License Manager resides. To verify, please do the following:

1. Run lswhere.exe (which is located in the SPSS directory, see above) from the problematic SPSS Client machine and take note of the displayed output. The following is an example of the output:

==========================
Sentinel LM 8.x.x Search Tool For License Servers
Copyright (C) 20xx Rainbow Technologies, Inc.

Server Address : xxx.xxx.xxx.xxx
Server Name : Machine_A
==========================

If the Safenet Sentinel License Manager machine is not listed or you encounter the error, "Error[17]: Probably no servers are running on this subnet.", please add the following system environment variable to the IBM SPSS Statistics/Modeler client and run lswhere.exe again:

==========================
Variable: LSHOST
Value: Name or IP address of the License Manager machine
==========================

For information about defining environment variables, see the Network License Administrator's Guide. If using the LSHOST environment variable does not render the Safenet Sentinel License Manager machine, try using LSFORCEHOST instead.

2. When you see the Safenet Sentinel License Manager machine name and corresponding IP address listed in the lswhere output, ping the displayed Server Name from a command line, e.g.

==========================
ping Machine_A
==========================

An example of the resulting output is as follows:
==========================
Unknown host Machine_A
==========================

If the ping command is unable to resolve the Server Name, you have a name resolution problem and must address it (with help from your IT Administrator/Help Desk team) before IBM SPSS Statistics/Modeler can acquire a license from the Sentinel License Manager.

RELATED INFORMATION
 Need more help? Our Modeler forum is Live! [https://developer.ibm.com/answers/topics/modeler/?smartspace=predictive-analytics]
Need more help? Our Licensing forum is Live! [https://developer.ibm.com/answers/topics/spsslicensing.html]
A simplified Chinese translation is available [http://www.ibm.com/support/docview.wss?uid=swg21641554]

Cross reference information Segment Product Component Platform Version Edition Business Analytics SPSS Statistics Platform Independent Not Applicable Business Analytics SPSS Text Analytics for Surveys Platform Independent Not Applicable Business Analytics SPSS Amos Windows Not Applicable Business Analytics SPSS SamplePower Platform Independent Not Applicable
HISTORICAL NUMBER
 51910

Question:
Error #2070 I purchased the SPSS grad pack and put one of the licenses on one computer and another on this one. This computer crashed and I was forced to reformat the hard drive. Subsequently, I lost SPSS in the process. After reinstalling the program, when I attempted to open a data set I received this error:
Error #2070 The application is unable to communicate properly with the license server. The license server may be down, or there may be other network-related communication or DNS issues interfering. This command is not executed. Specific symptom number: 3.  WHat is causing this?

Answer: The above error can be caused by invalid values entered during the licensing phase of installing SPSS Statistics/Modeler or the client machine cannot reach the Sentinel License Manager host using the machine Hostname.


IBM In FileNet Workplace XT .csv files open as a text file instead of using MS Excel - United States Mime type TECHNOTE (TROUBLESHOOTING)

THIS DOCUMENT APPLIES ONLY TO THE FOLLOWING LANGUAGE VERSION(S):
 US English

PROBLEM(ABSTRACT)
 The .csv file was created through WorkplaceXT and it only can be opened as the text file instead of the Excel file

SYMPTOM
The .csv file can be opened as the Excel from ACCE and outside of WorkplaceXT but not from inside of the WorkplaceXT

CAUSE
Mime Type was not set correctly when creating the .csv documents via WorkplaceXT

DIAGNOSING THE PROBLEM
When creating a .csv document through ACCE, the mime Type is "application/vnd.ms-excel" shown under the Properties tab and Content Element tab.

 * When adding a .csv document through WorkplaceXT, the mime Type shows "text/csv" from the Properties tab and Content Element tab in ACCE.
 * Verify if the .csv document with the mime Type "application/vnd.ms-excel" is opened as Excel file in WorkplaceXT

RESOLVING THE PROBLEM
Add a section to Web.xml mapping the extension to the mime type:

 *
 * <mime-mapping>
   <extension>csv</extension>
   <mime-type>application/vnd.ms-excel</mime-type>
   </mime-mapping>

Question: In FileNet Workplace XT .csv files open as a text file instead of using MS Excel The .csv file was created through WorkplaceXT and it only can be opened as the text file instead of the Excel file, and the mime type is text/csv, not application/vnd.ms-excel. However, when creating the same .csv document through ACCE, the mime Type is "application/vnd.ms-excel" shown under the Properties tab and Content Element tab.

Answer:
Add a section to Web.xml mapping the extension to the mime type:

 *
 * <mime-mapping>
   <extension>csv</extension>
   <mime-type>application/vnd.ms-excel</mime-type>
   </mime-mapping>


IBM SPSS Student Version and Graduate Pack Resources - United States SPSS Support Acquisition Statistics Stats Grad Pack Student TECHNOTE (FAQ)

QUESTION
 Where do I get support for IBM SPSS Student Version or Graduate Pack software?

ANSWER
Step 1:
For installation & licensing issues on Student version and Graduate pack, contact your vendor.

 * Hearne [http://www.hearne.software/Software/SPSS-Grad-Packs-for-Students-by-IBM/FAQ]
 * On the Hub [http://onthehub.com/]
 * StudentDiscounts.com [http://studentdiscounts.com/contact-us.aspx]
 * JourneyEd [https://www.journeyed.com/contact]
 * thinkEDU [https://thinkedu.desk.com/]
 * Studica [http://www.studica.com/technical-support]

Cross reference information Segment Product Component Platform Version Edition Business Analytics SPSS Amos Windows Not Applicable Grad Pack, Shrinkwrap, Campus Business Analytics SPSS Modeler Platform Independent Not Applicable Business Analytics SPSS Text Analytics for Surveys Windows Not Applicable Business Analytics SPSS Statistics Platform Independent Not Applicable Campus Edition, Grad Pack, Student Version

Question:
Need help accessing my SPSS access code? I downloaded SPSS GradPack (Standard) 25 6 Months for my Mac. The IBM SPSS Statistics 24 licensing page pops up for me to enter the code. I enter the code provided and then hit next, and it tells me the code is too short to be valid? What code do I use then? I need this resolved fast, my first assignment is due soon. I was only given a 16-digit access code, not a 20-digit?

This dW Answers question is about an IBM document with the Title:
SPSS Student Version and Graduate Pack Resources

Answer: For installation & licensing issues on Student version and Graduate pack, contact your vendor.


IBM Getting a warning message 'You do not have the correct administrator privileges' when attempting to license a SPSS Statistics product on Mac OS. - United States  TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 You have successfully installed an IBM SPSS Statistics product on a Mac computer. When you start the License Authorization Wizard (LAW) to enter the authorization code for licensing.

You receive the following message:

"Warning! You do not have the correct administrator privileges to license this product. Log in as administrator and try again, or contact your network administrator to correct this issue.

"

Once this message is displayed the only option available is "OK" to click on and you cannot enter your authorization code.

RESOLVING THE PROBLEM
Below is a picture of the warning:

[/support/docview.wss?uid=swg21966637&aid=1] [/support/docview.wss?uid=swg21966637&aid=1]

If you encounter this message, perform the following procedure:

 1.  If open, close the IBM SPSS Statistics product.
 2.  If open, close the License Authorization Wizard.
 3.  Open Finder.
 4.  Select the 'Go' menu.
 5.  Select the 'Utilities' menu.
 6.  Open the 'Terminal' program.
 7.  Type (copy/paste) the following command:

     cd /Applications/IBM/SPSS/Statistics/
 8.
 9.  Press Enter/Return.
 10. Perform the procedure corresponding to the Statistics product version as described below:

Statistics Release 20  1. Type (copy/paste) the following command:

    sudo chown -R root:admin 20

 2. Press Enter/Return.
 3. Close Terminal.
 4. Launch the License Authorization Wizard.
 5. The warning message should no longer appear.
 6. License your IBM SPSS Statistics product.

Statistics Release 21  1. Type (copy/paste) the following command:

    sudo chown -R root:admin 21

 2. Press Enter/Return.
 3. Close Terminal.
 4. Launch the License Authorization Wizard.
 5. The warning message should no longer appear.
 6. License your IBM SPSS Statistics product.

Statistics Release 22  1. Type (copy/paste) the following command:

    sudo chown -R root:admin 22

 2. Press Enter/Return.
 3. Close Terminal.
 4. Launch the License Authorization Wizard.
 5. The warning message should no longer appear.
 6. License your IBM SPSS Statistics product.

Statistics Release 23  1. Type (copy/paste) the following command:

    sudo chown -R root:admin 23

 2. Press Enter/Return.
 3. Close Terminal.
 4. Launch the License Authorization Wizard.
 5. The warning message should no longer appear.
 6. License your IBM SPSS Statistics product.

Statistics Release 24  1. Type (copy/paste) the following command:

    sudo chown -R root:admin 24

 2. Press Enter/Return.
 3. Close Terminal.
 4. Launch the License Authorization Wizard.
 5. The warning message should no longer appear.
 6. License your IBM SPSS Statistics product.
 7.
 8.

Statistics Release 25  1. Type (copy/paste) the following command:

    sudo chown -R root:admin 25

 2. Press Enter/Return.
 3. Close Terminal.
 4. Launch the License Authorization Wizard.
 5. The warning message should no longer appear.
 6. License your IBM SPSS Statistics product.

To confirm the changes have been made (1) In the Terminal window change directory to below path (example for release 22)

cd /Applications/IBM/SPSS/Statistics/22/SPSSStatistics.app/Contents

then, type the following:

ls -l

(2) Press Enter/Return.

If you see some or all of subfolders shows a group ownership other than 'admin' (as displayed in Picture1), the procedure did not succeed. You will need to have your Mac IT support contact IBM SPSS Support for further assistance.

Picture1:
[/support/docview.wss?uid=swg21966637&aid=2] [/support/docview.wss?uid=swg21966637&aid=2]

Picture 2:

If you see some or all of subfolders shows a group ownership of 'admin' (as displayed in Picture2), the procedure was successful.
[/support/docview.wss?uid=swg21966637&aid=3] [/support/docview.wss?uid=swg21966637&aid=3]

This behavior is also reported on the following product correction report (APAR): [https://www-304.ibm.com/support/entdocview.wss?uid=swg1PI41134]
[https://www-304.ibm.com/support/entdocview.wss?uid=swg1PI41134]
https://www.ibm.com/support/entdocview.wss?uid=swg1PI41134 [https://www-304.ibm.com/support/entdocview.wss?uid=swg1PI41134]

An IBM ID is required to access this material.

If needed, an IBM ID may be created at https://ibm.biz/ibm_web_id [https://ibm.biz/ibm_web_id]

RELATED INFORMATION
 Need more help? Our Statistics forum is Live! [https://developer.ibm.com/answers/topics/statistics.html?smartspace=predictive-analytics]
Need more help? Our Licensing forum is Live! [https://developer.ibm.com/answers/topics/spsslicensing.html]

Question:
Hey, how can I transfer my spss 24 licence from my old macbook to the new one?

I made the backup from my laptop to my new one, but SPSS doesnt allow me to start, because of the licence! Also I tried the SPSS Licence wizard on the new macbook, but it is not possible to fill in my licence

I didn't find a option to deactivate the licence on the previous macbook.. how can I solve this problem?

Answer:
Type (copy/paste) the following command:

    sudo chown -R root:admin 20

 2. Press Enter/Return.
 3. Close Terminal.
 4. Launch the License Authorization Wizard.


IBM Product upgrade installed a second instance of the DE, causing upgrade failure. - United States DEL2INST; Tivoli; Deployment; Engine; FQDN; Duplicate; acsi TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 The Deployment Engine should only have one instance installed on a server with IBM products installed. In this case, a second DE was installed, which caused the failure of the Product upgrade.
Error: Wrong Deployment Engine.

SYMPTOM
Product install failed. You will get a message similar to this:
You are updating an instance of <Product name> that was installed using
the Tivoli Deployment Engine (DE) located at "/home/nc_admin/.acsi_<Fully Qualified hostname>".
However you are now using the DE located at "/home/nc_admin/.acsi_<hostname>".

When the DE is installed as non-root ( in this case nc_admin ), it will install the DE in the user home directory, in this case /home/nc_admin, and use the FQDN in the name: /home/nc_admin/.acsi_<Fully Qualified hostname>

CAUSE
Because the two Product installs used different versions of JVM, the underlying Java is using "hostname" for one version of JVM, and "Fully Qualified hostname" for the other. The DE normally uses the FQDN appended to the "acsi_" string to create the DE directory:

For example, if the Product is being installed as user "nc_admin" and the entry in /etc/hosts is this:

x.xx.xxx.xx server_name.corporation.net server_name

The hostname is "server_name"
Fully Qualified hostname (FQDN) is "server_name.corporation.net"

ENVIRONMENT
Upgrading existing product that uses the Deployment Engine on a UNIX server

DIAGNOSING THE PROBLEM
Output similar to this when the Product install fails:

the Tivoli Deployment Engine (DE) located at "/home/nc_admin/.acsi_<Fully qualified hostname>".
However you are now using the DE located at "<User_home>/nc_admin/.acsi_<hostname>"

RESOLVING THE PROBLEM
There are two options to fix this problem.

1) Make sure the current upgrade is using the same version of JVM as the original install.

2) Removing the newly created DE, which shouldn't have been created, then creating a link to the existing DE is the best work around in this case. The Product upgrade will see the link and add the information to the valid DE install.

*IMPORTANT NOTE: The Product install failure message will tell you what instance of the DE is valid, please refer to the error message in the "Symptom" section above.

 At this point there will be the following in the DE_HOME directory:

 .acsi_<FQDN> ( Valid DE installation )

 .acsi_<userid> ( link to .acsi_<FQDN> )

 .acsi_<hostname> ( Invalid DE directory created by the failed Product upgrade )

 This can be confirmed by referring to the Product install error.

 Removing the invalid DE and creating softlink:

 - Backup the original DE installation directory: <DE_HOME>/.acsi_<FQDN>

 - Move the new invalid DE directory to a backup directory: <DE_HOME>/.acsi_<hostname>

 - Create a soft link to the "good" DE install

 cd <DE_HOME>

 ln -s <DE_HOME>/.acsi_<FQDN> .acsi_<hostname>

 - Confirm the link was created successfully, it should look like this:
> ls -lart
lrwxrwxrwx 1 nc_admin ncoadmin <date> .acsi_<hostname> -> <DE_HOME>/.acsi_<FQDN>

3) Retry the product install. You will need to confirm there is no required cleanup before retrying the Product upgrade.

Question:
Product upgrade installed a second instance of the DE, causing upgrade failure. The Deployment Engine should only have one instance installed on a server with IBM products installed. In this case, a second DE was installed, which caused the failure of the Product upgrade. Error: Wrong Deployment Engine.

Product install failed. You will get a message similar to this: You are updating an instance of (Product name) that was installed using the Tivoli Deployment Engine (DE) located at "/home/nc_admin/.acsi_FQDN". However you are now using the DE located at "/home/nc_admin/.acsi_HOSTNAME".

When the DE is installed as non-root ( in this case nc_admin ), it will install the DE in the user home directory, in this case /home/nc_admin, and use the FQDN in the name: /home/nc_admin/.acsi_FQDN

Answer:
There are two options to fix this problem.

1) Make sure the current upgrade is using the same version of JVM as the original install.

2) Removing the newly created DE, which shouldn't have been created, then creating a link to the existing DE is the best work around in this case. The Product upgrade will see the link and add the information to the valid DE install.


IBM WebSphere DataPower SOA Appliance MQ Manager Object's connections are not closed as expected. - United States  TECHNOTE (FAQ)

QUESTION
 IBM WebSphere DataPower SOA appliance MQ Manager Object's connections are not closed as expected. This can happen when the mq-qm object uses the default value which is an empty string.

CAUSE
DataPower MQ manager object's idle connection is not closed when using default cache timeout.

ANSWER
Change the cache timeout on the IBM WebSphere DataPower MQ manager (mq-qm) object. You can start using a value of 60 seconds as the suggestion. The best practice is to use a value which should be less than the KeepAlive Timeout of the MQ Queue Manager (qmgr).

Question: What may be the cause of unclosed MQ object connections on DataPower? How can I resolve open MQ object connections that did not close out on DataPower?

Answer: Change the cache timeout on the IBM WebSphere DataPower MQ manager (mq-qm) object. You can start using a value of 60 seconds as the suggestion. The best practice is to use a value which should be less than the KeepAlive Timeout of the MQ Queue Manager (qmgr).


IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Image Construction and Composition Tool (CVE-2015-0410 and CVE-2014-6593) - United States  SECURITY BULLETIN

SUMMARY
 There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition Version 6 and 7 that are used by IBM Image Construction and Composition Tool. These issues were disclosed as part of the IBM Java SDK updates in January 2015.

VULNERABILITY DETAILS
CVEID: CVE-2015-0410 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0410]
DESCRIPTION: An unspecified vulnerability related to the Security component could allow a remote attacker to cause a denial of service.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100151 [https://exchange.xforce.ibmcloud.com/vulnerabilities/100151] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-6593 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6593]
DESCRIPTION: An unspecified vulnerability related to the JSSE component has partial confidentiality impact, partial integrity impact, and no availability impact.
CVSS Base Score: 4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100153 [https://exchange.xforce.ibmcloud.com/vulnerabilities/100153] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N)

AFFECTED PRODUCTS AND VERSIONS
IBM Image Construction and Composition Tool v2.2.1.3
IBM Image Construction and Composition Tool v2.3.1.0
IBM Image Construction and Composition Tool v2.3.2.0

REMEDIATION/FIXES
The solution is to apply the following IBM Image Construction and Composition Tool version fixes.

Upgrade the IBM Image Construction and Composition Tool to the following fix levels:

 *  For IBM Image Construction and Composition Tool v2.2.1.3  * IBM Image Construction and Composition Tool v2.2.1.3 Build 28
      http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=PureSystems&product=ibm/WebSphere/PureApplication+System&release=1.1.0.5&platform=All&function=fixId&fixids=ICCT_efix_Repository_2.2.1.3-28&includeSupersedes=0 [http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=PureSystems&product=ibm/WebSphere/PureApplication+System&release=1.1.0.5&platform=All&function=fixId&fixids=ICCT_efix_Repository_2.2.1.3-28&includeSupersedes=0]

   For IBM Image Construction and Composition Tool v2.3.1.0  * IBM Image Construction and Composition Tool v2.3.1.0 Build 38
      http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=PureSystems&product=ibm/WebSphere/PureApplication+System&release=2.0.0.1&platform=All&function=fixId&fixids=ICCT_efix_Repository_2.3.1.0-38&includeSupersedes=0 [http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=PureSystems&product=ibm/WebSphere/PureApplication+System&release=2.0.0.1&platform=All&function=fixId&fixids=ICCT_efix_Repository_2.3.1.0-38&includeSupersedes=0]

   For IBM Image Construction and Composition Tool v2.3.2.0  * IBM Image Construction and Composition Tool v2.3.2.0 Build 12
      http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=PureSystems&product=ibm/WebSphere/PureApplication+System&release=2.1.0.0&platform=All&function=fixId&fixids=ICCT_efix_Repository_2.3.2.0-12&includeSupersedes=0 [http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=PureSystems&product=ibm/WebSphere/PureApplication+System&release=2.1.0.0&platform=All&function=fixId&fixids=ICCT_efix_Repository_2.3.2.0-12&includeSupersedes=0]

WORKAROUNDS AND MITIGATIONS
None

GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

REFERENCES
Complete CVSS v2 Guide [http://www.first.org/cvss/v2/guide]
On-line Calculator v2 [http://nvd.nist.gov/CVSS-v2-Calculator]

RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/psirt]

ACKNOWLEDGEMENT
None

CHANGE HISTORY
 21 July 2015: Original Version Published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Question: Help with Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Image Construction and Composition Tool (CVE-2015-0410 and CVE-2014-6593) I need to understand details regarding "Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Image Construction and Composition Tool (CVE-2015-0410 and CVE-2014-6593)." Where can I find this information?

Answer:
CVEID: CVE-2015-0410 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0410]
DESCRIPTION: An unspecified vulnerability related to the Security component could allow a remote attacker to cause a denial of service.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100151 [https://exchange.xforce.ibmcloud.com/vulnerabilities/100151] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-6593 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6593]
DESCRIPTION: An unspecified vulnerability related to the JSSE component has partial confidentiality impact, partial integrity impact, and no availability impact.
CVSS Base Score: 4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100153 [https://exchange.xforce.ibmcloud.com/vulnerabilities/100153] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:P/A:N)


IBM Security Bulletin: Vulnerability in SSLv3 affects IBM HTTP Server (CVE-2014-3566) - United States  SECURITY BULLETIN

SUMMARY
 SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption (POODLE) attack. SSLv3 is enabled by default in the Apache based IBM HTTP Server.

VULNERABILITY DETAILS
CVE ID: CVE-2014-3566 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566]
DESCRIPTION: IBM HTTP Server could allow a remote attacker to obtain sensitive information, caused by a design error when using the SSLv3 protocol. A remote user with the ability to conduct a man-in-the-middle attack could exploit this vulnerability via a POODLE (Padding Oracle On Downgraded Legacy Encryption) attack to decrypt SSL sessions and access the plain text of encrypted connections.

CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/97013 [https://exchange.xforce.ibmcloud.com/vulnerabilities/97013] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

AFFECTED PRODUCTS AND VERSIONS
This vulnerability affects all versions and releases of IBM HTTP Server (IHS) component in all editions of WebSphere Application Server and bundling products.

REMEDIATION/FIXES
There is no separate interim fix for the PI27904 APAR that is associated with this issue, but the interim fix for APAR PI31516 (TLS Padding Vulnerability CVE-2014-8730 [http://www-01.ibm.com/support/docview.wss?uid=swg21692502]) includes the update for APAR PI27904. APAR PI27904 update disables SSLv3 by default for IHS 7.0 and newer, and adds the 'SSLProtocolEnable' directive into IHS 7.0.

The update for PI27904 will be included in fix packs 7.0.0.37, 8.0.0.10 and 8.5.5.4.

WORKAROUNDS AND MITIGATIONS
For all releases and versions of Apache based IBM HTTP Server, IBM recommends disabling SSLv3:

Add the following directive to the httpd.conf file to disable SSLv3 and SSLv2 for each context that contains "SSLEnable":

# Disable SSLv3 for CVE-2014-3566
# SSLv2 is disabled in V8R0 and later by default, and in typical V7
# and earlier configurations disabled implicitly when SSLv3 ciphers
# are configured with SSLCipherSpec.
SSLProtocolDisable SSLv3 SSLv2

Stop and restart IHS for the changes to take affect.

Note:

 * If you start IHS with the -f command line argument, or you use the "Include" directive to include alternate configuration files, you may need to search those filenames for SSLEnable.

 * If you configure SSL with SSLEnable in the global (non-virtualhost) scope, you will need to move SSLEnable into a virtualhost scope to add SSLProtocolDisable

IBM recommends that you review your entire environment to identify other areas that enable SSLv3 protocol and take appropriate mitigation (such as disabling SSLv3) and remediation actions. GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

IMPORTANT NOTE
 IBM strongly suggests that all System z customers be subscribed to the System z Security Portal to receive the latest critical System z security and integrity service. If you are not subscribed, see the instructions on the System z Security web site [http://www.ibm.com/systems/z/solutions/security_subintegrity.html]. Security and integrity APARs and associated fixes will be posted to this portal. IBM suggests reviewing the CVSS scores and applying all security or integrity fixes as soon as possible to minimize any potential risk.

REFERENCES
Complete CVSS v2 Guide [http://www.first.org/cvss/v2/guide]
On-line Calculator v2 [http://nvd.nist.gov/CVSS-v2-Calculator]
HTTPS advisor fails when SSLv3 is disabled on backend servers [http://www-01.ibm.com/support/docview.wss?uid=swg21691795]  TLS Padding vulnerability CVE-2014-8730 [http://www-01.ibm.com/support/docview.wss?uid=swg21692502]

RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/psirt]

CHANGE HISTORY
 15 October 2014: original document published
03 November 2014: added extra notes
02 December 2014: added link to reference section
28 January 2015: added links to CVE-2014-8730

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Question: how to Configure the server to only accept strong encryption protocols such as TLS1.1? how to Configure the server to only accept strong encryption protocols such as TLS1.1?

Answer:
For all releases and versions of Apache based IBM HTTP Server, IBM recommends disabling SSLv3:

Add the following directive to the httpd.conf file to disable SSLv3 and SSLv2 for each context that contains "SSLEnable":

# Disable SSLv3 for CVE-2014-3566
# SSLv2 is disabled in V8R0 and later by default, and in typical V7
# and earlier configurations disabled implicitly when SSLv3 ciphers
# are configured with SSLCipherSpec.
SSLProtocolDisable SSLv3 SSLv2

Stop and restart IHS for the changes to take affect.


IBM Unable to connect using network services: WebGUI or ssh after upgrading WebSphere DataPower firmware - United States  TECHNOTE (FAQ)

QUESTION
 Why can't I access the Web managment or ssh after upgrading firmware?

CAUSE
This can occur if you are using a custom certificate or authentication for the management services and any of the associated certificates are expired. Expired certificates are removed at upgrade time.

ANSWER
The first step is to verify that the network is functioning correctly using these commands:

show int

show int mode

show route

Those commands will show if there is any network activity as well as the ethernet link speed.

Once the network is confirmed, the quickest way to recover the web management and ssh services is to delete and recreate them with the default settings using the serial console.

The following commands will reset the RBM's, ACL's, WebGUI and SSH services to the default settings.

Note: If the ssh is working, you may omit any commands with the ssh.

config

web-mgmt

no ssl

exit

write mem

y

no web-mgmt

no ssh

rbm

reset

exit

acl web-mgmt

reset

exit

acl ssh

reset

exit

write mem (key step to remove the current settings)

y

web-mgmt <ip to listen on or 0.0.0.0 for all> <port to use default is9090>

ssh <ip to listen on or 0.0.0.0 for all> <port to use default is22>

write mem

y

Once complete, test the service and confirm you can now access the appliance. Then you may work to configure any custom certificates or authentication settings desired.

If this does not resolve the issue Contact DataPower Support [http://www.ibm.com/support/docview.wss?uid=swg21236322]

Cross reference information Segment Product Component Platform Version Edition Business Integration WebSphere DataPower B2B Appliance XB60 4.0.2, 4.0.1, 5.0.0, 6.0.0 All Editions Business Integration WebSphere DataPower SOA Appliances Firmware 4.0.2, 4.0.1, 5.0.0, 6.0.0, 6.0.1 Edition Independent Business Integration WebSphere DataPower XML Security Gateway XS40 Firmware 4.0.2, 4.0.1, 5.0.0, 6.0.0 All Editions

Question: Datapower WebGUI down due to an expired or invalid certificate The Datapower WebGUI is down due to an expired or invalid certificate. How can the WebGUI access be restored?

Answer:
The following commands will reset the RBM's, ACL's, WebGUI and SSH services to the default settings.

Note: If the ssh is working, you may omit any commands with the ssh.

config

web-mgmt

no ssl

exit

write mem

y

no web-mgmt

no ssh

rbm

reset

exit

acl web-mgmt

reset

exit

acl ssh

reset

exit

write mem (key step to remove the current settings)

y

web-mgmt <ip to listen on or 0.0.0.0 for all> <port to use default is9090>

ssh <ip to listen on or 0.0.0.0 for all> <port to use default is22>

write mem

y


IBM BigFix Server unable to gather site content from sync.bigfix.com (error: Unexpected HTTP response: 404) - United States  TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 Identifying a block between the BigFix Server and IBM BigFix's sync.bigfix.com content servers.

SYMPTOM
Error messages similar to the following in the BESRelay.log on the BigFix server:

 *
 *
 * http://sync.bigfix.com/cgi-bin/bfgather/bessupport?Time=1452540085:
 *
 *
 *
 *
 * Error messages similar to the following in the GatherDB.log on the BigFix server:
   Mon, 11 Jan 2016 14:43:22 -0500 -- Unexpected exception during gather of site BES Support: Unexpected HTTP response: 404

Note: If the BES Support cannot gather for the first time the entire console is empty of its UI elements.
CAUSE

 1. There is most likely an Intrusion Prevention System (IPS) between the BigFix server and our content sites at sync.bigfix.com that is dropping the download because it is detecting something in the download (one of the sites files) as being malicious. If you do not have an IPS between the BigFix server and the sync.bigfix.com servers; it may be the firewall or proxy appliance that is causing the issue.
 2. Another cause might be that Internet Explorer Enhanced Security Configuration is enabled for Administrators on the BigFix Windows server machine.

RESOLVING THE PROBLEM

 1. Check with the firewall/proxy/IPS/network admin and ask them to check the logs for dropped packets or downloads and to adjust the rules to allow the BES Support site content through.
 2. Try turning off Internet Explorer Enhanced Security Configuration [https://blogs.technet.microsoft.com/chenley/2011/03/10/how-to-turn-off-internet-explorer-enhanced-security-configuration/] for Administrators to see if this resolves the issue.

Question:
fixlets do not appear in console bigfix

Work with ILTM 9.2.7 / 9.5.4.38. In the bigfix console the fixlets do not appear, under the tree: Sites-> IBM License Reporting (ILTM) v9 -> Fixlets and Task.

Attached image. Do you have any ideas?

Greetings and thank you BigFix

Answer:
Check with the firewall/proxy/IPS/network admin and ask them to check the logs for dropped packets or downloads and to adjust the rules to allow the BES Support site content through.
 2. Try turning off Internet Explorer Enhanced Security Configuration [https://blogs.technet.microsoft.com/chenley/2011/03/10/how-to-turn-off-internet-explorer-enhanced-security-configuration/] for Administrators to see if this resolves the issue.


IBM PM66670: WHEN LOGIN ATTRIBUTE VALUE HAS "=" SIGN IN IT, INVALIDUNIQUENAME EXCEPTION IS THROWN. - United States   FIXES ARE AVAILABLE
8.0.0.4: WebSphere Application Server V8.0 Fix Pack 4 [http://www-01.ibm.com/support/docview.wss?uid=swg24033190]
8.5.0.1: WebSphere Application Server V8.5 Fix Pack 1 [http://www-01.ibm.com/support/docview.wss?uid=swg24033606]
8.0.0.5: WebSphere Application Server V8.0 Fix Pack 5 [http://www-01.ibm.com/support/docview.wss?uid=swg24033754]
8.5.0.2: WebSphere Application Server V8.5 Fix Pack 2 [http://www-01.ibm.com/support/docview.wss?uid=swg24034672]
8.0.0.6: WebSphere Application Server V8.0 Fix Pack 6 [http://www-01.ibm.com/support/docview.wss?uid=swg24034673]
8.0.0.7: WebSphere Application Server V8.0 Fix Pack 7 [http://www-01.ibm.com/support/docview.wss?uid=swg24035457]
8.0.0.8: WebSphere Application Server V8.0 Fix Pack 8 [http://www-01.ibm.com/support/docview.wss?uid=swg24036729]
8.0.0.9: WebSphere Application Server V8.0 Fix Pack 9 [http://www-01.ibm.com/support/docview.wss?uid=swg24037574]
8.0.0.10: WebSphere Application Server V8.0 Fix Pack 10 [http://www-01.ibm.com/support/docview.wss?uid=swg24039242]
8.0.0.11: WebSphere Application Server V8.0 Fix Pack 11 [http://www-01.ibm.com/support/docview.wss?uid=swg24040425]
8.0.0.12: WebSphere Application Server V8.0 Fix Pack 12 [http://www-01.ibm.com/support/docview.wss?uid=swg24041590]
8.0.0.13: WebSphere Application Server V8.0 Fix Pack 13 [http://www-01.ibm.com/support/docview.wss?uid=swg24042746]
8.0.0.14: WebSphere Application Server V8.0 Fix Pack 14 [http://www-01.ibm.com/support/docview.wss?uid=swg24044096]
8.0.0.15: WebSphere Application Server V8.0 Fix Pack 15 [http://www-01.ibm.com/support/docview.wss?uid=swg24044734]

SUBSCRIBE
You can track all active APARs for this component.

APAR STATUS
 * CLOSED AS PROGRAM ERROR.

ERROR DESCRIPTION
 *  UniqueName formation was incorrect which leads to login failure
   with 6/5/12 9:53:35:968 EDT] 00000087 UserRegistryI E
   SECJ0363E: Cannot create credential for the user tw=admin
   because of the following exception
   com.ibm.websphere.wim.exception.InvalidUniqueNameException:
   CWWIM0515E  The 'tw=admin' entity is not in the scope of the
   'defined' realm.
    at
   com.ibm.ws.wim.RepositoryManager.getRepositoryIndexByUniqueName(
   RepositoryManager.java:333)
    at
   com.ibm.ws.wim.RepositoryManager.getRepositoryID(RepositoryManag
   er.java:279)
    at
   com.ibm.ws.wim.ProfileManager.retrieveEntityFromRepository(Profi
   leManager.java:2800)
    at
   com.ibm.ws.wim.ProfileManager.retrieveEntity(ProfileManager.java
   :2916)
    at
   com.ibm.ws.wim.ProfileManager.getImpl(ProfileManager.java:1614)
    at
   com.ibm.ws.wim.ProfileManager.genericProfileManagerMethod(Profil
   eManager.java:364)
    at
   com.ibm.ws.wim.ProfileManager.get(ProfileManager.java:417)
    at
   com.ibm.websphere.wim.ServiceProvider.get(ServiceProvider.java:3
   66)
    at
   com.ibm.ws.wim.registry.util.BridgeUtils.getEntityByIdentifier(B
   ridgeUtils.java:622)
    at
   com.ibm.ws.wim.registry.util.UniqueIdBridge.getUniqueUserId(Uniq
   ueIdBridge.java:202)
    at
   com.ibm.ws.wim.registry.WIMUserRegistry$6.run(WIMUserRegistry.ja
   va:568)
    at
   com.ibm.ws.security.auth.ContextManagerImpl.runAs(ContextManager
   Impl.java:5445)

LOCAL FIX

PROBLEM SUMMARY
 *  ****************************************************************
   * USERS AFFECTED:  All users of IBM WebSphere Application      *
   *                  Server                                      *
   ****************************************************************
   * PROBLEM DESCRIPTION: Virtual member manager (VMM) throws     *
   *                      InvalidUniqueNameException when the     *
   *                      login attribute value contains an       *
   *                      equal sign "=".                         *
   ****************************************************************
   * RECOMMENDATION:                                              *
   ****************************************************************
   VMM throws InvalidUniqueNameException when the login attribute
   value contains a "=". When an equal sign "=" is encountered in
   the login name for example 'tw=admin', VMM treats this as a
   distinguished name (DN) and hence the login fails.

PROBLEM CONCLUSION
 *  You need to set a custom property using the following
   command

   $AdminTask configureAdminWIMUserRegistry {-customProperties
   {"com.ibm.ws.wim.registry.allowDNPrincipalNameAsLiteral
   =true"} }

   When this property is set, VMM determines whether the login
   name ends with a baseEntry. If the login name does not end
   with a baseEntry it is not treated as a DN and the login is
   successful.

   The fix for this APAR is currently targeted for inclusion in
   fix packs 8.0.0.4 and 8.5.0.1.  Please refer to the
   Recommended Updates page for delivery information:
   http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980 [http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980]

TEMPORARY FIX

COMMENTS

APAR INFORMATION
 * APAR NUMBER
   PM66670

 * REPORTED COMPONENT NAME
   WEBS APP SERV N

 * REPORTED COMPONENT ID
   5724H8800

 * REPORTED RELEASE
   800

 * STATUS
   CLOSED PER

 * PE
   NoPE

 * HIPER
   NoHIPER

 * SPECIAL ATTENTION
   NoSpecatt

 * SUBMITTED DATE
   2012-06-13

 * CLOSED DATE
   2012-07-13

 * LAST MODIFIED DATE
   2012-07-13

 * APAR IS SYSROUTED FROM ONE OR MORE OF THE FOLLOWING:

 * APAR IS SYSROUTED TO ONE OR MORE OF THE FOLLOWING:

FIX INFORMATION
 * FIXED COMPONENT NAME
   WEBS APP SERV N

 * FIXED COMPONENT ID
   5724H8800

APPLICABLE COMPONENT LEVELS
 * R800 PSY
   UP

 * R850 PSY
   UP

Question:
Why does my login fail when I use the ltpa-usrnm attribute? You use a Domino server as your LDAP, and the login attribute you want to use is ltpa-usrnm. This is acceptable, as the login attribute can be set accordingly in the wimconfig.xml. When the search string is built for the login, it is in the form, cn=username, o=orgname.

This cause the following exception to the returned:

[3/30/16 9:56:03:453 CDT] 000000f7 exception E com.ibm.ws.wim.adapter.ldap.LdapConnection getAttributes CWWIM4520E The 'javax.naming.InvalidNameException: "CN=username/O=orgname": [LDAP: error code 34 - Invalid DN Syntax]; remaining name '"CN=username/O=orgname'";

Answer:
You need to set a custom property using the following
   command

   $AdminTask configureAdminWIMUserRegistry {-customProperties
   {"com.ibm.ws.wim.registry.allowDNPrincipalNameAsLiteral
   =true"} }

   When this property is set, VMM determines whether the login
   name ends with a baseEntry. If the login name does not end
   with a baseEntry it is not treated as a DN and the login is
   successful.

   The fix for this APAR is currently targeted for inclusion in
   fix packs 8.0.0.4 and 8.5.0.1.


IBM Command Line configuration for J2EE Data Collector - United States ITCAM; J2EE; CLI; configurator; CAMJ2ALL; CAMJ2INST TECHNOTE (FAQ)

QUESTION
 Command Line configuration for J2EE DC is not working as expected when trying to enable MS or TT features.

CAUSE
Interactive CLI configuration is not supported with ITCAM J2EE 7.1.1, including last available level 7.1.1.0.4.

ANSWER
Supported methods are GUI and silent configuration.

Also, silent configuration fully works both on UNIX and Windows platforms only at level 7.1.1.0.4.
Before this maintenance level there were issues and limitations with Managing Server and Transaction Tracking integration.

Support Command Line configuration for J2EE DC will possibly be added in some future patch via Request For Enhancement.

Question: Command Line and Silent configuration for ITCAM J2EE 7.1.1 agent I am seeing unexpected behaviors when using Command Line (interactive or silent) configuration for J2EE DC when trying to enable MS or TT features. These do not seem to work. Are these configuration methods supported?

Answer:
Supported methods are GUI and silent configuration.

Also, silent configuration fully works both on UNIX and Windows platforms only at level 7.1.1.0.4.
Before this maintenance level there were issues and limitations with Managing Server and Transaction Tracking integration.

Support Command Line configuration for J2EE DC will possibly be added in some future patch via Request For Enhancement.


IBM Security Bulletin:  Multiple vulnerabilities in IBM Java Runtime affect API Connect - United States  SECURITY BULLETIN

SUMMARY
 There are multiple vulnerabilities in IBM® Runtime Environment Java™ used by IBM API Connect.

These issues were disclosed as part of the IBM Java SDK updates in July 2017.

VULNERABILITY DETAILS
CVEID: CVE-2017-10115 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10115]
DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded, JRockit JCE component could allow an unauthenticated attacker to obtain sensitive information resulting in a high confidentiality impact using unknown attack vectors.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/128876 [https://exchange.xforce.ibmcloud.com/vulnerabilities/128876] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID: CVE-2017-10116 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10116]
DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded, JRockit Security component could allow an unauthenticated attacker to take control of the system.
CVSS Base Score: 8.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/128877 [https://exchange.xforce.ibmcloud.com/vulnerabilities/128877] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)

AFFECTED PRODUCTS AND VERSIONS
IBM API Connect V5.0.0.0 - V5.0.7.2

REMEDIATION/FIXES

Affected Product Addressed in VRMF APAR Remediation/First Fix IBM API Connect

V5.0.0.0 - 5.0.6.3 5.0.6.4 LI79805 Addressed in IBM API Connect V5.0.6.4.

Follow this link and find the "APIConnect_Management" and "apiconnect-collective-controller" packages:

https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+API+Connect&release=5.0.6.3&platform=All&function=all [https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+API+Connect&release=5.0.6.2&platform=All&function=all] IBM API Connect

V5.0.7.0 - 5.0.7.2 5.0.8.0 LI79805 Addressed in IBM API Connect V5.0.8.0.

Follow this link and find the "APIConnect_Management" and "apiconnect-collective-controller" packages:

https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+API+Connect&release=5.0.7.0&platform=All&function=all [https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&product=ibm/WebSphere/IBM+API+Connect&release=5.0.7.0&platform=All&function=all] GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

REFERENCES
Complete CVSS v3 Guide [http://www.first.org/cvss/user-guide]
On-line Calculator v3 [http://www.first.org/cvss/calculator/3.0]
IBM Java SDK July 2017 Security Bulletin [http://www-01.ibm.com/support/docview.wss?uid=swg22007002]
RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/psirt]

CHANGE HISTORY
 18 September 2017: original document published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Question: Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect API Connect I need to understand details regarding Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect API Connect (CVE-2017-10115, CVE-2017-10116). Where can I find this information?

Answer:
CVEID: CVE-2017-10115 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10115]
DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded, JRockit JCE component could allow an unauthenticated attacker to obtain sensitive information resulting in a high confidentiality impact using unknown attack vectors.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/128876 [https://exchange.xforce.ibmcloud.com/vulnerabilities/128876] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID: CVE-2017-10116 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10116]
DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded, JRockit Security component could allow an unauthenticated attacker to take control of the system.
CVSS Base Score: 8.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/128877 [https://exchange.xforce.ibmcloud.com/vulnerabilities/128877] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)


IBM EIF probe not receiving itm events - United States om_tec.conf eif probe itm event clearing omnibus TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 ITM is sending events to EIF probe which is then forwarded to the OMNIbus Server. Client is observing that the clearing event is sent per the ITM trace/log but the event does not seem to be received into EIF or OMNIbus as the triggered event is still seen in OMNIbus.

SYMPTOM
Situation in ITM is no longer true but event is not cleared in OMNIbus.

DIAGNOSING THE PROBLEM
The iptrace shows that the EIF probe on the OMNIbus side is resetting/closing(<RST>) the TCP/IP connection after it receives the event and it never shows up in the EIF logs, so the event is just dropped.

RESOLVING THE PROBLEM
The solution is to set the connection_mode in your om_tec.config on the ITM Server (TEMS) to use

connection_less

instead of

connection oriented.

That is, change this line in your om_tec.config

ConnectionMode=co
to
ConnectionMode=connection_less

You will need to restart the EIF on your ITM. (tacmd refreshTECinfo -t eif)

Question:
EIF probe not receiving itm events EIF probe not receiving itm events
Why is the event in the netcool isn't cleaned ?

Answer:
ITM is sending events to EIF probe which is then forwarded to the OMNIbus Server. Client is observing that the clearing event is sent per the ITM trace/log but the event does not seem to be received into EIF or OMNIbus as the triggered event is still seen in OMNIbus.

SYMPTOM
Situation in ITM is no longer true but event is not cleared in OMNIbus.

DIAGNOSING THE PROBLEM
The iptrace shows that the EIF probe on the OMNIbus side is resetting/closing(<RST>) the TCP/IP connection after it receives the event and it never shows up in the EIF logs, so the event is just dropped.


IBM Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Business Monitor (CVE-2015-0138) - United States  SECURITY BULLETIN

SUMMARY
 WebSphere Application Server is shipped as a component of IBM Business Monitor. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin.

VULNERABILITY DETAILS
CVEID: CVE-2015-0138 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0138]

DESCRIPTION: A vulnerability in various IBM SSL/TLS implementations could allow a remote attacker to downgrade the security of certain SSL/TLS connections. An IBM SSL/TLS client implementation could accept the use of an RSA temporary key in a non-export RSA key exchange ciphersuite. This could allow a remote attacker using man-in-the-middle techniques to facilitate brute-force decryption of TLS/SSL traffic between vulnerable clients and servers.
This vulnerability is also known as the FREAK attack.

CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/100691 [https://exchange.xforce.ibmcloud.com/#/vulnerabilities/100691] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

AFFECTED PRODUCTS AND VERSIONS
The following products are affected:

 * WebSphere Business Monitor V7.0.0.x
 * IBM Business Monitor V7.5.x
 * IBM Business Monitor V8.0.1.x
 * IBM Business Monitor V8.5.5.0
 * IBM Business Monitor V8.5.6.0

REMEDIATION/FIXES
To remediate this issue, refer to Security Bulletin: Vulnerability with RSA Export Keys may affect IBM WebSphere Application Server (CVE-2015-0138) [http://www.ibm.com/support/docview.wss?uid=swg21698613]

GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

IMPORTANT NOTE
 IBM strongly suggests that all System z customers be subscribed to the System z Security Portal to receive the latest critical System z security and integrity service. If you are not subscribed, see the instructions on the System z Security web site [http://www.ibm.com/systems/z/solutions/security_subintegrity.html]. Security and integrity APARs and associated fixes will be posted to this portal. IBM suggests reviewing the CVSS scores and applying all security or integrity fixes as soon as possible to minimize any potential risk.

REFERENCES
Complete CVSS v2 Guide [http://www.first.org/cvss/v2/guide]
On-line Calculator v2 [http://nvd.nist.gov/CVSS-v2-Calculator]

RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/psirt]

ACKNOWLEDGEMENT
CVE-2015-0138 was reported to IBM by Karthikeyan Bhargavan of the PROSECCO team at INRIA

CHANGE HISTORY
 2015-03-30: Original document published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

RELATED INFORMATION
 A Japanese translation is available [http://www.ibm.com/support/docview.wss?uid=swg21701544]

Cross reference information Segment Product Component Platform Version Edition Business Integration WebSphere Business Monitor Security AIX, Linux, Linux zSeries, Solaris, Windows 7.0.0.5, 7.0.0.4, 7.0.0.3, 7.0.0.2, 7.0

Question: Help with Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Business Monitor (CVE-2015-0138) I need to understand details regarding Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Business Monitor (CVE-2015-0138). Where can I find this information?

Answer:
CVEID: CVE-2015-0138 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0138]

DESCRIPTION: A vulnerability in various IBM SSL/TLS implementations could allow a remote attacker to downgrade the security of certain SSL/TLS connections. An IBM SSL/TLS client implementation could accept the use of an RSA temporary key in a non-export RSA key exchange ciphersuite. This could allow a remote attacker using man-in-the-middle techniques to facilitate brute-force decryption of TLS/SSL traffic between vulnerable clients and servers.
This vulnerability is also known as the FREAK attack.

CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/100691 [https://exchange.xforce.ibmcloud.com/#/vulnerabilities/100691] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)


IBM Limitations when deploying more than one Rule Execution Server console - United States  TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 It is possible to deploy several Rule Execution Server (RES) Console in the same cluster, however there are some administrative interactions from RES components to RES console that may not work due to the presence of more than one RES management stack within the same administrative scope.

SYMPTOM
When a RES component makes an attempt to interact with a RES Console management stack (through a JMX invocation) the following exception may occur if more than one RES Console is deployed within an administrative cell:

...
java.lang.IllegalStateException
at ilog.rules.res.mbean.util.IlrSingleMBeanInvocationHandler.invoke(Unknown Source)
...

Note: a similar exception can be seen when no RES Console is found so the first thing to verify is that a RES Console is completely deployed and that it passes the diagnostic properly before considering the issue in this present note.

CAUSE
The scope of the management API (JMX) is typically that of the Cell (WebSphere), Domain (Weblogic) or Partition(JBoss). RES components that interact directly with the RES Console management stack normally expect to find exactly one RES Console within the this management scope : an error can arise from not finding a RES Console management stack, as well as finding more than one.

RESOLVING THE PROBLEM
Certain use cases are supported that involve deploying more than one RES console in a cluster, most notably for situations where a active/passive fail over is needed, see the following document for more information: Clustering Rule Execution Server (RES) management console [http://www.ibm.com/support/docview.wss?uid=swg21426014]

However there is a number of limitations that one can face when several RES consoles are deployed within the same administrative cell, such as :

 1. The use of the API ilog.rules.session.IlrManagementSession (reference [http://publib.boulder.ibm.com/infocenter/brjrules/v7r1/index.jsp?topic=/com.ibm.websphere.ilog.jrules.doc/html/api/html/ilog/rules/res/session/IlrManagementSession.html]) may fail with a java.lang.IllegalStateException as per the symptom above. In this situation, the only option is to deploy a single RES Console per cell.
 2. With JRules 6.x deploying RSM in a cell where more than one RES console is deployed can lead to java.lang.IllegalStateException as per the symptom above when attempting to add an SSP through the RSM console.
 3. With JRules 7.x DVS scenario suite executions initiated from Rule Studio to be run on a remote Java EE server in a cell where more than one RES console is deployed may fail with java.lang.IllegalStateException as per the symptom above.
 4. The use of interceptors (i.e. IlrSessionInterceptor implementations) may fail with a java.lang.IllegalStateException or an error message such as ilog.rules.res.session.interceptor.IlrSessionInterceptorException: Unable to find RuleApp /myruleapp/myruleset for use by the interceptor. In this situation, the only option is to deploy a single RES Console per cell.

For situations 2. and 3. note that DVS and RSM are normally deployed in a non-production environment since they support the testing process of the rules prior to their deployment to production. So in practice it is not necessary to deploy multiple RES console instances for fail over purpose when in a testing environment. The recommendation is then to set up RES console and SSP in a testing cell that is separate from the production cell. In this testing cell, only one instance of RES console should be installed. RELATED INFORMATION
#Setting up multipe XUs in one cell [http://www-01.ibm.com/support/docview.wss?uid=swg21400807]

Cross reference information Segment Product Component Platform Version Edition Business Integration IBM Operational Decision Manager Platform Independent 8.5, 8.0.1, 8.0, 7.5 Enterprise

Question:
Rules view statistics shows no statistics

We converted the single RulesMgrSvr in a cluster and added a second RulesMgrSvr member on another node.

The rules console on the first node works fine.

On the second member view statistics fails, no statistics or error messages are shown

Answer: It is possible to deploy several Rule Execution Server (RES) Console in the same cluster, however there are some administrative interactions from RES components to RES console that may not work due to the presence of more than one RES management stack within the same administrative scope.


IBM How do I change the default 'fit content by' behaviour of Daeja viewer in IBM Content Navigator, to fit content by height or width? - United States fit by height; fit by width; fit; default fit; Daeja viewer; FileNet viewer; Daeja; scale TECHNOTE (FAQ)

QUESTION
 How do I change the default 'fit content by' behaviour of Daeja viewer in IBM Content Navigator, to fit content by height or width?

ANSWER
In Content Navigator v2.0.2

In the ..navigator.war/applets/filenetViewer_properties.jsp file, set the value of the parameter 'scale' as follows

To fit content by width, specify - scale: "ftow",
To fit content by height, specify - scale: "ftoh",

Here's another way to modify the behaviour:

 * make the same changes above to the filenetViewer_properties.jsp under ECMClient\configure\explodedformat\navigator\applets folder.
 * Rebuild and redeploy the ear file.
 * Restart the application server

Save the changes and they should get picked up when the viewer is re-launched.

In Content Navigator v2.0.3

The same parameter-value pair mentioned above can be added in the Additional Settings section of the Daeja ViewONE panel, of the admin desktop. Add the parameter-value pair to the Additional Settings section of

 * the Professional tab for modifying the behaviour of the Daeja Professional viewer
 * the Virtual tab for modifying the behaviour of the Daeja Virtual viewer.

Click New in the Additional Settings section to add the parameter-value pair. Save the changes and they should get picked up when the viewer is re-launched.

Question: How do I change the default 'fit content by' behaviour of Daeja viewer in IBM Content Navigator, to fit content by height or width? How do I change the default 'fit content by' behaviour of Daeja viewer in IBM Content Navigator v2.0.3, to fit content by height or width?

Answer:
The same parameter-value pair mentioned above can be added in the Additional Settings section of the Daeja ViewONE panel, of the admin desktop. Add the parameter-value pair to the Additional Settings section of

 * the Professional tab for modifying the behaviour of the Daeja Professional viewer
 * the Virtual tab for modifying the behaviour of the Daeja Virtual viewer.

Click New in the Additional Settings section to add the parameter-value pair. Save the changes and they should get picked up when the viewer is re-launched.


Question: mirandabarby I have purchased a grad pack of SPSS. How do I enter the authorisation code to activate/license

Answer: For installation & licensing issues on Student version and Graduate pack, contact your vendor.